Database
WordPress Vulnerability Database (page 1243)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- High8.8Cross-Site Request Forgery to Comment Modification
Throws SPAM Away
<3.3.1Update to 3.3.1
- High8.8Cross-Site Request Forgery to Arbitrary Settings Update
LiveSync for WordPress
≤1.0No patch available
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
FormCraft – Form Builder
<1.2.6Update to 1.2.6
- Medium6.4Authenticated (Contributor+) Cross-Site Scripting
//// WP BORN BABIES PLUGIN ///
≤1.0No patch available
- High8.8Cross-Site Request Forgery to Settings Reset
Discy - Social Questions and Answers WordPress Theme
<5.2Update to 5.2
- Medium6.1Reflected Cross-Site Scripting
Ask Me - Responsive Questions & Answers WordPress
<6.8.2Update to 6.8.2
- Medium5.4Cross-Site Scripting
Iptanus File Upload
≤4.16.3Update to 4.16.4
- Medium5.4Missing Authorization to Settings Reset
Files Download Delay
<1.0.7Update to 1.0.7
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
Donations
≤1.8No patch available
- High7.5Regular Expression Denial of Service (ReDoS)
Insert Special Characters
≤1.0.4Update to 1.0.5
- Medium6.1Reflected Cross-Site Scripting via 'name'
Loginizer
≤1.7.5Update to 1.7.6
- Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting
Pie Forms — Drag & Drop Form Builder
<1.4.9.4Update to 1.4.9.4
- High7.2Cross-Site Scripting via Cloudflare Country Code
GTM4WP – A Google Tag Manager (GTM) plugin for WordPress
≤1.15Update to 1.15.1
- High8.8Cross-Site Request Forgery
WP Simple Adsense Insertion
≤2.0Update to 2.1
- Medium6.1Reflected Cross-Site Scripting
Quick Restaurant Reservations
≤1.4.1Update to 1.4.2
- Medium6.1Reflected Cross-Site Scripting
WooCommerce Green Wallet Gateway
<1.0.2Update to 1.0.2
- High8.8Cross-Site Request Forgery to Settings Update
Database Backup for WordPress
<2.5.2Update to 2.5.2
- Critical9.8Unauthenticated SQL Injection
FundEngine – Donation and Crowdfunding Platform
≤1.4.2Update to 1.5.0
- Medium6.1Reflected Cross-Site Scripting
WP Statistics – Simple, privacy-friendly Google Analytics alternative
<13.2.2Update to 13.2.2
- High7.2Cross-Site Scripting
Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam
≤2.0.0Update to 2.0.1
- Medium5.3Builder forms Addon For WordPress <= 5.4 - Unauthenticated Private Message Disclosure
WPQA - Builder forms Addon For WordPress
≤5.4Update to 5.5
- Medium4.8Authenticated (Admin+) Cross-Site Scripting
Quotes llama
≤0.7Update to 1.0.0
- Medium6.1Authenticated (Admin+) Stored Cross-Site Scripting
Easy FAQ with Expanding Text
≤3.2.8.3.1No patch available
- Medium6.1Builder forms Addon For WordPress <= 5.3 - Reflected Cross-Site Scripting
WPQA - Builder forms Addon For WordPress
<5.4Update to 5.4
- Medium6.4Cross-Site Scripting
Use Any Font | Custom Font Uploader
≤6.2.7Update to 6.2.8
- High7.2Authenticated (Admin+) SQL Injection
CUBE SLIDER
≤1.2No patch available
- Medium5.5Stored Cross-Site Scripting
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
≤1.14.11Update to 1.14.12
- Medium6.1Reflected Cross-Site Scripting
StaffList
≤3.1.6Update to 3.1.7
- High7.2Authenticated (Admin+) SQL Injection via ids Parameter
Note Press
≤0.1.10No patch available
- Medium5.4Missing Authorization Checks
All In One Login
≤1.0.9Update to 1.1.0